Linux kernel (drivers/nvme/host): On the NVMe/RDMA initiator, an async-event command can be submitted against an admin

Impact

On the NVMe/RDMA initiator, an async-event command can be submitted against an admin queue that error recovery is concurrently destroying, giving a use-after-free in the host kernel. The node corrupts freed transport state and typically panics, dropping every tenant workload on it.

Who can reach it

Initiator-side, but the trigger is remote: error recovery only runs when the RDMA connection breaks, and the target (or a peer that can disrupt the fabric path) decides when that happens. If your compute nodes mount NVMe/RDMA volumes from targets a tenant controls or can influence, that peer can time connection drops against the controller's own AER traffic. Requires nvme-rdma in use; no local privilege needed on the initiator.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: keep NVMe/RDMA initiator traffic on a fabric segment tenants cannot disturb, and drain nodes that show repeated transport error recovery.

References